@atlasauth/cli 0.24.0 → 0.25.0

package/dist/commands/api-keys.js

@@ -1,96 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.apiKeys = apiKeys;
-const args_1 = require("../args");
-const errors_1 = require("../errors");
-const output_1 = require("../output");
-const secrets_1 = require("../secrets");
-const shared_1 = require("./shared");
-const COLUMNS = [
-    { header: 'ID', get: (k) => k.id },
-    { header: 'SUBJECT_TYPE', get: (k) => k.subject_type },
-    { header: 'SUBJECT_ID', get: (k) => k.subject_id },
-    { header: 'NAME', get: (k) => k.name },
-    { header: 'PREFIX', get: (k) => k.prefix },
-    { header: 'CREATED', get: (k) => (0, output_1.fmtTime)(k.created_at) },
-];
-const SUBJECT_TYPES = ['user', 'organization'];
-function parseSubjectType(value, flag) {
-    if (!value)
-        throw new errors_1.CliError(`api-keys create requires ${flag} <user|organization>.`);
-    if (!SUBJECT_TYPES.includes(value)) {
-        throw new errors_1.CliError(`${flag} must be one of: ${SUBJECT_TYPES.join(', ')} (got '${value}').`);
-    }
-    return value;
-}
-/** `atlas api-keys <list|create|revoke>` — maps onto `client.apiKeys.*`. */
-async function apiKeys(ctx, args) {
-    const sub = args.positionals[1];
-    const json = (0, shared_1.wantsJson)(args.values);
-    switch (sub) {
-        case 'list': {
-            const { client } = (0, shared_1.requireClient)(ctx, args.values);
-            // Optional narrowing to one subject; the route itself is not cursor-paged.
-            const subjectType = (0, args_1.str)(args.values, 'subject-type');
-            const page = await client.apiKeys.list({
-                subject_type: subjectType ? parseSubjectType(subjectType, '--subject-type') : undefined,
-                subject_id: (0, args_1.str)(args.values, 'subject-id'),
-            });
-            if (json)
-                (0, output_1.printJson)(ctx.io, page);
-            else
-                ctx.io.out((0, output_1.renderTable)(COLUMNS, page.data));
-            return 0;
-        }
-        case 'create': {
-            const subjectType = parseSubjectType((0, args_1.str)(args.values, 'subject-type'), '--subject-type');
-            const subjectId = (0, args_1.str)(args.values, 'subject-id');
-            if (!subjectId)
-                throw new errors_1.CliError('api-keys create requires --subject-id <id>.');
-            const { client } = (0, shared_1.requireClient)(ctx, args.values);
-            const key = await client.apiKeys.create({
-                subject_type: subjectType,
-                subject_id: subjectId,
-                name: (0, args_1.str)(args.values, 'name'),
-            });
-            // The secret is revealed exactly once. By default it goes to a 0600 file
-            // and only the path is printed; --print-secret is the explicit opt-out.
-            const printSecret = args.values['print-secret'] === true;
-            const { secret, ...rest } = key;
-            if (printSecret) {
-                ctx.io.err('atlas: warning: printing the API key because --print-secret was given. It may end up in your shell history, terminal scrollback or CI logs.');
-                if (json)
-                    (0, output_1.printJson)(ctx.io, key);
-                else {
-                    ctx.io.out(`Created API key ${key.id}.`);
-                    ctx.io.out(`Secret (shown once): ${secret}`);
-                }
-                return 0;
-            }
-            const { path } = (0, secrets_1.writeSecretFile)((0, secrets_1.productDir)(ctx.env, (0, args_1.str)(args.values, 'product') ?? 'atlasauth'), `api-key-${key.id}.env`, { ATLAS_API_KEY: secret ?? '' }, { force: args.values.force === true, comment: `End-user API key ${key.id} (${subjectType} ${subjectId}).` });
-            if (json) {
-                (0, output_1.printJson)(ctx.io, { ...rest, secret_file: path });
-            }
-            else {
-                ctx.io.out(`Created API key ${key.id}.`);
-                ctx.io.out(`Secret written to ${path} (mode 0600). It is shown nowhere else.`);
-            }
-            return 0;
-        }
-        case 'revoke': {
-            const id = (0, shared_1.requireArg)(args.positionals, 2, 'api-key-id');
-            const { client } = (0, shared_1.requireClient)(ctx, args.values);
-            const result = await client.apiKeys.delete(id);
-            if (json)
-                (0, output_1.printJson)(ctx.io, result);
-            else
-                ctx.io.out(`Revoked API key ${result.id}.`);
-            return 0;
-        }
-        default:
-            throw new errors_1.CliError(sub
-                ? `Unknown subcommand 'api-keys ${sub}'. Try: list, create, revoke.`
-                : 'api-keys needs a subcommand: list, create, revoke.');
-    }
-}
-//# sourceMappingURL=api-keys.js.map

package/dist/commands/api-keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/commands/api-keys.ts"],"names":[],"mappings":";;AA4BA,0BA0EC;AArGD,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAyE;AACzE,wCAAyD;AACzD,qCAAgE;AAEhE,MAAM,OAAO,GAAqB;IAChC,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;IAClC,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;IACtD,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE;IAClD,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;IACtC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE;IAC1C,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAA,gBAAO,EAAC,CAAC,CAAC,UAAU,CAAC,EAAE;CACzD,CAAC;AAEF,MAAM,aAAa,GAAiC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AAE7E,SAAS,gBAAgB,CAAC,KAAyB,EAAE,IAAY;IAC/D,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,iBAAQ,CAAC,4BAA4B,IAAI,uBAAuB,CAAC,CAAC;IACxF,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAA0B,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,iBAAQ,CAAC,GAAG,IAAI,oBAAoB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,KAA0B,CAAC;AACpC,CAAC;AAED,4EAA4E;AACrE,KAAK,UAAU,OAAO,CAAC,GAAe,EAAE,IAAgB;IAC7D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEpC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,2EAA2E;YAC3E,MAAM,WAAW,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;gBACrC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvF,UAAU,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;aAC3C,CAAC,CAAC;YACH,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;;gBAC7B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAA,oBAAW,EAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,WAAW,GAAG,gBAAgB,CAAC,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,gBAAgB,CAAC,CAAC;YACzF,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YACjD,IAAI,CAAC,SAAS;gBAAE,MAAM,IAAI,iBAAQ,CAAC,6CAA6C,CAAC,CAAC;YAClF,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBACtC,YAAY,EAAE,WAAW;gBACzB,UAAU,EAAE,SAAS;gBACrB,IAAI,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;aAC/B,CAAC,CAAC;YACH,yEAAyE;YACzE,wEAAwE;YACxE,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;YACzD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;YAChC,IAAI,WAAW,EAAE,CAAC;gBAChB,GAAG,CAAC,EAAE,CAAC,GAAG,CACR,6IAA6I,CAC9I,CAAC;gBACF,IAAI,IAAI;oBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;qBAC5B,CAAC;oBACJ,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;oBACzC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;gBAC/C,CAAC;gBACD,OAAO,CAAC,CAAC;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,IAAA,yBAAe,EAC9B,IAAA,oBAAU,EAAC,GAAG,CAAC,GAAG,EAAE,IAAA,UAAG,EAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,WAAW,CAAC,EAC/D,WAAW,GAAG,CAAC,EAAE,MAAM,EACvB,EAAE,aAAa,EAAE,MAAM,IAAI,EAAE,EAAE,EAC/B,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,OAAO,EAAE,oBAAoB,GAAG,CAAC,EAAE,KAAK,WAAW,IAAI,SAAS,IAAI,EAAE,CAC5G,CAAC;YACF,IAAI,IAAI,EAAE,CAAC;gBACT,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;gBACzC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qBAAqB,IAAI,yCAAyC,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,CAAC,CAAC;QACX,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,GAAG,IAAA,mBAAU,EAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;YACzD,MAAM,EAAE,MAAM,EAAE,GAAG,IAAA,sBAAa,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI;gBAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;;gBAC/B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,mBAAmB,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QAED;YACE,MAAM,IAAI,iBAAQ,CAChB,GAAG;gBACD,CAAC,CAAC,gCAAgC,GAAG,+BAA+B;gBACpE,CAAC,CAAC,oDAAoD,CACzD,CAAC;IACN,CAAC;AACH,CAAC"}

package/dist/commands/auth.d.ts

@@ -1,25 +0,0 @@
-import { type ParsedArgs } from '../args';
-import type { RunContext } from '../context';
-/**
- * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
- * with one cheap Backend call, then store it under a named profile (0600).
- *
- * Validating before saving is the point: a login that silently stored a typo'd
- * key would surface only later as a baffling 401 on an unrelated command. We
- * spend one `users.list({ limit: 1 })` round-trip here so every later command
- * can trust the stored credential. `--url` / `--secret-key` skip the prompts
- * for non-interactive setup (CI), mirroring the `ATLAS_*` env overrides.
- */
-export declare function login(ctx: RunContext, args: ParsedArgs): Promise<number>;
-/**
- * `atlas logout` — forget one profile's stored credential. If it was the active
- * profile, the active pointer falls back to any remaining profile so the CLI
- * isn't left pointing at nothing.
- */
-export declare function logout(ctx: RunContext, args: ParsedArgs): Promise<number>;
-/**
- * `atlas whoami` — report the active profile and instance without any network
- * call. The secret is always masked; the per-field source tells a user whether
- * an `ATLAS_*` env var is shadowing the stored profile.
- */
-export declare function whoami(ctx: RunContext, args: ParsedArgs): Promise<number>;

package/dist/commands/auth.js

@@ -1,102 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.login = login;
-exports.logout = logout;
-exports.whoami = whoami;
-const backend_1 = require("@atlasauth/backend");
-const args_1 = require("../args");
-const errors_1 = require("../errors");
-const output_1 = require("../output");
-const project_1 = require("../project");
-const shared_1 = require("./shared");
-const operator_1 = require("./operator");
-/**
- * `atlas login` — prompt for an API URL + a secret key, PROVE the key works
- * with one cheap Backend call, then store it under a named profile (0600).
- *
- * Validating before saving is the point: a login that silently stored a typo'd
- * key would surface only later as a baffling 401 on an unrelated command. We
- * spend one `users.list({ limit: 1 })` round-trip here so every later command
- * can trust the stored credential. `--url` / `--secret-key` skip the prompts
- * for non-interactive setup (CI), mirroring the `ATLAS_*` env overrides.
- */
-async function login(ctx, args) {
-    const { values } = args;
-    // `--device`: operator sign-in through Atlas's own sign-in page (no key stored).
-    if (values.device === true)
-        return (0, operator_1.deviceLogin)(ctx, args);
-    const profile = (0, args_1.str)(values, 'profile') || 'default';
-    const apiUrl = (0, args_1.str)(values, 'url') ||
-        (await ctx.prompt.text('Atlas API URL', { default: backend_1.DEFAULT_API_URL })) ||
-        backend_1.DEFAULT_API_URL;
-    const secretKey = (0, args_1.str)(values, 'secret-key') || (await ctx.prompt.secret('Atlas secret key (sk_...)'));
-    if (!secretKey)
-        throw new errors_1.CliError('A secret key is required to log in.');
-    // Prove the credential before persisting it. A platform key (psk_, for
-    // `atlas init`) is proven against the platform API instead.
-    try {
-        if (secretKey.startsWith('psk_') || /^atlas_(live|test)_psk_/.test(secretKey))
-            await (0, project_1.httpFor)(ctx, { secretKey, apiUrl }).get('/v1/platform/apps');
-        else
-            await ctx.makeClient({ secretKey, apiUrl }).users.list({ limit: 1 });
-    }
-    catch (err) {
-        if (err instanceof backend_1.AtlasApiError) {
-            throw new errors_1.CliError(`Secret key rejected by ${apiUrl} (HTTP ${err.status}${err.code ? `, ${err.code}` : ''}). Nothing was saved.`);
-        }
-        // A network/DNS failure, not a bad key — say so distinctly.
-        const detail = err instanceof Error ? err.message : String(err);
-        throw new errors_1.CliError(`Could not reach ${apiUrl}: ${detail}. Nothing was saved.`);
-    }
-    const file = ctx.config.load();
-    file.profiles[profile] = { api_url: apiUrl, secret_key: secretKey };
-    file.active_profile = profile;
-    ctx.config.save(file);
-    ctx.io.out(`Logged in to ${apiUrl} as profile '${profile}'.`);
-    ctx.io.out(`Credential stored at ${ctx.config.path} (mode 0600).`);
-    return 0;
-}
-/**
- * `atlas logout` — forget one profile's stored credential. If it was the active
- * profile, the active pointer falls back to any remaining profile so the CLI
- * isn't left pointing at nothing.
- */
-async function logout(ctx, args) {
-    const { values } = args;
-    const file = ctx.config.load();
-    const profile = (0, args_1.str)(values, 'profile') || file.active_profile || 'default';
-    if (!file.profiles[profile]) {
-        ctx.io.out(`No stored credential for profile '${profile}'.`);
-        return 0;
-    }
-    delete file.profiles[profile];
-    if (file.active_profile === profile) {
-        file.active_profile = Object.keys(file.profiles)[0];
-    }
-    ctx.config.save(file);
-    ctx.io.out(`Logged out of profile '${profile}'.`);
-    return 0;
-}
-/**
- * `atlas whoami` — report the active profile and instance without any network
- * call. The secret is always masked; the per-field source tells a user whether
- * an `ATLAS_*` env var is shadowing the stored profile.
- */
-async function whoami(ctx, args) {
-    const auth = (0, shared_1.resolveAuth)(ctx, args.values);
-    if ((0, shared_1.wantsJson)(args.values)) {
-        (0, output_1.printJson)(ctx.io, {
-            profile: auth.profile,
-            api_url: auth.apiUrl,
-            secret_key: (0, shared_1.maskSecret)(auth.secretKey),
-            key_source: auth.keySource,
-            url_source: auth.urlSource,
-        });
-        return 0;
-    }
-    ctx.io.out(`Profile:    ${auth.profile}`);
-    ctx.io.out(`API URL:    ${auth.apiUrl} (${auth.urlSource})`);
-    ctx.io.out(`Secret key: ${(0, shared_1.maskSecret)(auth.secretKey)} (${auth.keySource})`);
-    return 0;
-}
-//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":";;AAmBA,sBAsCC;AAOD,wBAkBC;AAOD,wBAkBC;AA3GD,gDAAoE;AACpE,kCAA+C;AAE/C,sCAAqC;AACrC,sCAAsC;AACtC,wCAAqC;AACrC,qCAA8D;AAC9D,yCAAyC;AAEzC;;;;;;;;;GASG;AACI,KAAK,UAAU,KAAK,CAAC,GAAe,EAAE,IAAgB;IAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,iFAAiF;IACjF,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAA,sBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1D,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,SAAS,CAAC;IAEpD,MAAM,MAAM,GACV,IAAA,UAAG,EAAC,MAAM,EAAE,KAAK,CAAC;QAClB,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,OAAO,EAAE,yBAAe,EAAE,CAAC,CAAC;QACtE,yBAAe,CAAC;IAClB,MAAM,SAAS,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAEtG,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,iBAAQ,CAAC,qCAAqC,CAAC,CAAC;IAE1E,uEAAuE;IACvE,4DAA4D;IAC5D,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,MAAM,IAAA,iBAAO,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;;YAC7I,MAAM,GAAG,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,uBAAa,EAAE,CAAC;YACjC,MAAM,IAAI,iBAAQ,CAChB,0BAA0B,MAAM,UAAU,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,uBAAuB,CAC9G,CAAC;QACJ,CAAC;QACD,4DAA4D;QAC5D,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,iBAAQ,CAAC,mBAAmB,MAAM,KAAK,MAAM,sBAAsB,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACpE,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC;IAC9B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,gBAAgB,MAAM,gBAAgB,OAAO,IAAI,CAAC,CAAC;IAC9D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,IAAI,eAAe,CAAC,CAAC;IACnE,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAG,IAAA,UAAG,EAAC,MAAM,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,SAAS,CAAC;IAE3E,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,qCAAqC,OAAO,IAAI,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC;IACX,CAAC;IAED,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,cAAc,KAAK,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEtB,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,0BAA0B,OAAO,IAAI,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,MAAM,CAAC,GAAe,EAAE,IAAgB;IAC5D,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAE3C,IAAI,IAAA,kBAAS,EAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,EAAE;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,UAAU,EAAE,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC;YACtC,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QACH,OAAO,CAAC,CAAC;IACX,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1C,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC7D,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,eAAe,IAAA,mBAAU,EAAC,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5E,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/commands/config.d.ts

@@ -1,104 +0,0 @@
-import { type ParsedArgs, type Values } from '../args';
-import { type ConfigHttp } from '../config-http';
-import type { RunContext } from '../context';
-import { type Format, type Json } from '../serialize';
-/** A config document ready for disk / comparison: a plain, redacted JSON value. */
-type Config = Json;
-/** `atlas config export|import` — Auth0 `deploy-cli`-style config-as-code. */
-export declare function config(ctx: RunContext, args: ParsedArgs): Promise<number>;
-export declare function resolveFormat(values: Values): Format;
-export interface Change {
-    type: string;
-    action: 'create' | 'update' | 'delete';
-    key: string;
-    /** The live document (absent on a create). Carried for `atlas config plan`'s field diff. */
-    before?: Config;
-    /** The desired document (absent on a delete). */
-    after?: Config;
-}
-/** A planned change and the call that applies it. */
-export interface PlannedChange extends Change {
-    apply: () => Promise<void>;
-}
-/** What `atlas config import` would do: the changes, the unchanged count and the skipped deletes. */
-export interface ConfigPlan {
-    changes: PlannedChange[];
-    unchanged: number;
-    skippedDeletes: Change[];
-    /** Live resources owned by a connected platform: shown for information, never changed. */
-    managed: Array<{
-        type: string;
-        key: string;
-        managedBy: string;
-    }>;
-}
-/**
- * Diff a config directory against the live instance. Nothing is written: the
- * returned changes carry their own `apply`. Used by `atlas config import` and by
- * `atlas migrate better-auth` (which shows the plan before applying it).
- */
-export declare function planConfigImport(http: ConfigHttp, opts: {
-    dir: string;
-    format: Format;
-    env: NodeJS.ProcessEnv;
-    prune: boolean;
-    forceHook?: boolean;
-}): Promise<ConfigPlan>;
-/** One differing field between the live and the desired document. */
-export interface FieldDiff {
-    path: string;
-    before?: Json;
-    after?: Json;
-}
-/** Leaf-level differences between two documents, as dotted paths (arrays compare whole). */
-export declare function diffFields(before: Json | undefined, after: Json | undefined, path?: string): FieldDiff[];
-/**
- * The environment `${VAR}` placeholders resolve against: the process env, then
- * `--secrets-file` (a dotenv file) on top. The file holds credentials, so it
- * must be readable by its owner only (mode 0600 or stricter); anything looser
- * is refused rather than read. POSIX only: Windows has no such mode bits.
- */
-export declare function readSecretsEnv(ctx: RunContext, values: Values): NodeJS.ProcessEnv;
-/** `${VAR}` placeholders still in a planned change (no env value and no --secrets-file entry). */
-export declare function unresolvedPlaceholders(changes: Change[]): string[];
-/** The resource types a single config file may hold, in the order they are applied. */
-export declare function configTypes(): string[];
-/**
- * Resolve `atlas plan|apply [<path>]`: a directory of per-type files (as
- * `atlas config export` writes), or ONE file whose top-level keys are resource
- * types (`instance`, `webhook_endpoints`, …), split into a temp directory.
- * `cleanup` removes that temp directory.
- */
-/** Config files `atlas plan` / `atlas apply` pick up from the current directory when given no path. */
-export declare const DEFAULT_CONFIG_FILES: string[];
-/**
- * Load an `atlas.config.ts` (or .js/.mjs): its default export is the config
- * object, or a function (sync or async) returning it. A .ts file runs on
- * Node's own type stripping (Node 22.18+ / 23.6+), so it adds no dependency.
- */
-export declare function loadCodeConfig(path: string): Promise<unknown>;
-/**
- * `atlas plan [<file|dir>]`: the read-only diff of `atlas config plan`, taking
- * a single config file as well. `--check` exits 2 on drift for CI.
- */
-export declare function planCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
-/**
- * `atlas apply [<file|dir>]`: plan, show it, confirm, then apply in the fixed
- * resource order (see {@link configTypes}). `--yes` skips the question (needed
- * when there is no terminal); `--check` only plans and exits 2 on drift.
- * Refuses to apply while any `${VAR}` placeholder is unresolved, so a missing
- * secret is never sent as the literal text.
- */
-export declare function applyCommand(ctx: RunContext, args: ParsedArgs): Promise<number>;
-export declare function printPlan(ctx: RunContext, changes: Change[], unchanged: number, skippedDeletes: Change[], opts: {
-    dryRun: boolean;
-    prune: boolean;
-}): void;
-/**
- * Replace `${ENV_VAR}` placeholders inside any string with the environment's
- * value — the one sanctioned way a secret enters an import without ever living
- * on disk. An unset variable is left verbatim so the plan surfaces it rather
- * than silently blanking a credential.
- */
-export declare function interpolate(value: Json, env: NodeJS.ProcessEnv): Json;
-export {};